feat: add MCP Apps support (renders_ui DSL, weather dashboard demo)

[crisnahine]

implements MCP Apps support per ext-apps draft spec (2026-01-26). closes #202.

changes

• ActionMCP::MIME_TYPE_APP_HTML constant (text/html;profile=mcp-app)
• renders_ui "ui://..." class macro on Tool. validates URI scheme and visibility values at class-load time. emits nested _meta.ui.resourceUri only, no legacy flat _meta["ui/resourceUri"] anywhere (pinned by a negative test).
• Capability#client_supports_ui? instance helper. key-presence check on capabilities.extensions["io.modelcontextprotocol/ui"]. lives on Capability so any tool/prompt/resource_template can call it.
• WeatherDashboardTemplate at ui://weather/dashboard with self-contained HTML. csp connectDomains and prefersBorder are emitted on the resource content (resources/read), following the apps.mdx canonical examples.
• existing WeatherTool gets renders_ui. text and structured output are preserved.

tests

test/action_mcp/mcp_apps_test.rb, 13 tests:

• renders_ui happy path with and without visibility:
• composition with meta(...) on orthogonal keys
• negative test pinning that the deprecated flat ui/resourceUri key is never emitted
• URI validation: non-String, non-ui://, empty
• visibility validation: unknown values
• client_supports_ui?: extension present, extension absent, no session, nil capabilities
• weather tool/template end-to-end

spec compliance

• _meta.ui.resourceUri nested only, per apps.mdx Tool Metadata section
• tools/list filtering by visibility is host-side per apps.mdx, no server-side filter added
• csp/permissions/prefersBorder are emitted on the resources/read content payload, following the apps.mdx canonical examples

notes

• rebased onto current master (clean, no conflicts)
• bin/rails test: 794 tests, 0 failures
• bin/rubocop: clean

[crisnahine]

rebased onto master, CI green on the new base.

three corrections since the previous push:

• dropped the class-level meta ui: block on the dashboard template. csp/prefersBorder are content-only per apps.mdx, they belong on resolve, not on the listing.
• added validation-branch coverage on renders_ui (non-String URI, non-Array visibility, empty array, unknown values, duplicates) plus the no-session and nil-capabilities paths on client_supports_ui?. 14 tests now.
• HTML entity for the sun glyph in the demo HEREDOC instead of unicode escape.